--- a/jaxp/src/java.xml/share/classes/com/sun/org/apache/xalan/internal/xsltc/trax/TemplatesImpl.java Wed Jul 05 22:43:19 2017 +0200
+++ b/jaxp/src/java.xml/share/classes/com/sun/org/apache/xalan/internal/xsltc/trax/TemplatesImpl.java Fri Jan 20 19:09:53 2017 +0000
@@ -1,5 +1,5 @@
/*
- * Copyright (c) 2007, 2016, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2007, 2017, Oracle and/or its affiliates. All rights reserved.
*/
/*
* Licensed to the Apache Software Foundation (ASF) under one or more
@@ -37,6 +37,7 @@
import java.io.ObjectOutputStream;
import java.io.ObjectStreamField;
import java.io.Serializable;
+import java.lang.RuntimePermission;
import java.lang.module.Configuration;
import java.lang.module.ModuleDescriptor;
import java.lang.module.ModuleFinder;
@@ -45,7 +46,11 @@
import java.lang.reflect.Layer;
import java.lang.reflect.Module;
import java.security.AccessController;
+import java.security.CodeSigner;
+import java.security.CodeSource;
+import java.security.PermissionCollection;
import java.security.PrivilegedAction;
+import java.security.ProtectionDomain;
import java.util.Arrays;
import java.util.HashMap;
import java.util.Map;
@@ -177,6 +182,7 @@
_loadedExternalExtensionFunctions = mapEF;
}
+ @Override
public Class<?> loadClass(String name) throws ClassNotFoundException {
Class<?> ret = null;
// The _loadedExternalExtensionFunctions will be empty when the
@@ -196,6 +202,10 @@
Class defineClass(final byte[] b) {
return defineClass(null, b, 0, b.length);
}
+
+ Class defineClass(final byte[] b, ProtectionDomain pd) {
+ return defineClass(null, b, 0, b.length, pd);
+ }
}
@@ -482,16 +492,24 @@
// the module needs access to runtime classes
Module thisModule = TemplatesImpl.class.getModule();
-
+ // the module also needs permission to access each package
+ // that is exported to it
+ PermissionCollection perms =
+ new RuntimePermission("*").newPermissionCollection();
Arrays.asList(Constants.PKGS_USED_BY_TRANSLET_CLASSES).forEach(p -> {
thisModule.addExports(p, m);
+ perms.add(new RuntimePermission("accessClassInPackage." + p));
});
- // java.xml needs to instanitate the translet class
+ CodeSource codeSource = new CodeSource(null, (CodeSigner[])null);
+ ProtectionDomain pd = new ProtectionDomain(codeSource, perms,
+ loader, null);
+
+ // java.xml needs to instantiate the translet class
thisModule.addReads(m);
for (int i = 0; i < classCount; i++) {
- _class[i] = loader.defineClass(_bytecodes[i]);
+ _class[i] = loader.defineClass(_bytecodes[i], pd);
final Class superClass = _class[i].getSuperclass();
// Check if this is the main class
--- a/jaxp/test/javax/xml/jaxp/unittest/transform/TransformerTest.java Wed Jul 05 22:43:19 2017 +0200
+++ b/jaxp/test/javax/xml/jaxp/unittest/transform/TransformerTest.java Fri Jan 20 19:09:53 2017 +0000
@@ -1,5 +1,5 @@
/*
- * Copyright (c) 2014, 2016, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2014, 2017, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
@@ -24,6 +24,7 @@
package transform;
import static jaxp.library.JAXPTestUtilities.getSystemProperty;
+import static jaxp.library.JAXPTestUtilities.tryRunWithTmpPermission;
import java.io.BufferedReader;
import java.io.ByteArrayInputStream;
@@ -217,7 +218,7 @@
* @summary Test for JDK-6272879
*/
@Test
- public final void testBug6272879() throws IOException, TransformerException {
+ public final void testBug6272879() throws Exception {
final String xsl =
"<?xml version=\"1.0\" encoding=\"ISO-8859-1\"?>" + LINE_SEPARATOR +
"<xsl:stylesheet version=\"1.0\" xmlns:xsl=\"http://www.w3.org/1999/XSL/Transform\">" + LINE_SEPARATOR +
@@ -274,9 +275,11 @@
System.out.println("Result after transformation:");
System.out.println("============================");
- OutputFormat format = new OutputFormat();
- format.setIndenting(true);
- new XMLSerializer(System.out, format).serialize(document);
+ tryRunWithTmpPermission(() -> {
+ OutputFormat format = new OutputFormat();
+ format.setIndenting(true);
+ new XMLSerializer(System.out, format).serialize(document);
+ }, new RuntimePermission("accessClassInPackage.com.sun.org.apache.xml.internal.serialize"));
System.out.println();
System.out.println("Node content for element valeur2:");
@@ -529,7 +532,7 @@
}
}
- public void run() throws IOException, TransformerException {
+ public void run() throws Exception {
printSnippet("Source:", sourceXml);
printSnippet("Stylesheet:", xsl);
@@ -545,9 +548,11 @@
System.out.println("Result after transformation:");
System.out.println("============================");
- OutputFormat format = new OutputFormat();
- format.setIndenting(true);
- new XMLSerializer(System.out, format).serialize(document);
+ tryRunWithTmpPermission(() -> {
+ OutputFormat format = new OutputFormat();
+ format.setIndenting(true);
+ new XMLSerializer(System.out, format).serialize(document);
+ }, new RuntimePermission("accessClassInPackage.com.sun.org.apache.xml.internal.serialize"));
System.out.println();
checkNodeNS(document.getElementsByTagName("test1").item(0), "ns2", "ns2", null);
@@ -566,9 +571,7 @@
* definitions to reset the default namespace
*/
@Test
- public final void testBug8162598() throws IOException,
- TransformerException
- {
+ public final void testBug8162598() throws Exception {
new Test8162598().run();
}